Checklist do not equal compliance One of the major gaps I hear when talking to MSPs about security and compliance is a lack of understanding the “why” behind the security checklist being instituted in client environments. Many of us out there follow some checklist, especially for Microsoft 365, that we try to implement in our […]
Checklist do not equal compliance One of the major gaps I hear when talking to MSPs about security and compliance is a lack of understanding the “why” behind the security checklist being instituted in client environments. Many of us out there follow some checklist, especially for Microsoft 365, that we try to implement in our […]
🛡️ Mapping Microsoft 365 Security Controls to NIST CSF 2.0 NIST has released the 2.0 draft of its Cybersecurity Framework so I wanted to create a new enablement guide that maps Microsoft security controls to the framework. The Framework has been used widely to reduce cybersecurity risks since its initial publication in 2014. Many organizations […]
Many of us out there are using Microsoft Teams as our main source of collaboration. This includes chats, meetings, and even file sharing. As an organization, its where we are potentially sharing tons, if not all, of our sensitive information which is why it is SO important to protect. I wanted to walk you through […]
When the Cybersecurity & Infrastructure Security Agency (CISA) released the Secure Cloud Business applications (SCuBA) project, I was pretty excited but it left me wanting more. I wanted more enablement materials and a way to map this back to broader cybersecurity frameworks we are adopting vs just having a checklist to follow. For this reason, […]
In this article, I wanted to break down some of the trends in the Cyber Insurance market that I am seeing along with some predictions for 2023 and beyond. This is not a post I typically do but I have been fascinated by the rapid evolution we are seeing unfold so I wanted to share […]
CISA has recently released a project called SCuBA which is providing a security baseline for Microsoft 365. This project is currently in the alpha stages but there is a ton of great recommendations that span across the suite offerings like Azure AD, Exchange, Teams, Defender, OneDrive, SharePoint, and even Power Platform. If you are someone […]
MFA settings in Azure AD have evolved so much over the past few years and I believe that will continue at an even greater pace with the introduction of Microsoft Entra. I believe if you are a progressive MSP, you have moved your customers to licensing that supports Conditional Access over the legacy “per user” […]
In my previous blog post, I talked about the major considerations when adding roles for GDAP relationships. In some instances, you may want to bump up security a step further and pair GDAP with PIM or privileged identity management. This would allow you to have just in time access to customer workloads for users in […]
If you have been following along with my blog, you know I have written a few articles on Granular Delegated Admin Privileges or GDAP. If you are unfamiliar with what that is, please check out my first article, which is a high-level overview. One component of GDAP that may seem overwhelming is choosing the roles […]
This month, Microsoft had a technical release of GDAP or Granular Delegated Admin Privileges for M365 workloads (Azure coming later this year). If you checked out my previous article, you know that GDAP is going to replacing existing delegated admin relationships with a true model of least privilege access. GDAP is ultimately going to improve […]
Traditionally, both distributors (Microsoft Indirect Providers/CSP Tier 1s) and MSPs (Indirect Resellers) have established Delegated Admin Privileges (DAP) with all downstream customers. This allows distributors to license customer tenants and provide support. It allows you, as the MSP, to provide support and perform day to day management tasks via Partner Center. The large security concern […]
